I would consider a brute force method to begin with and then refactor from there. Here's where I'd start:

First, you need to decide how to start the processing:

• Begin at a point where all partitions are quiet?
• Accept the fact that some jobs may have already started when you begin and either ignore them or check the RC and report accordingly (don't worry about start information)?

I'd parse the log file line by line and use a hash to keep the necessary info for the jobs in progress:

$jobs{$partition}{jobname}
$jobs{$partition}{starttime}
$jobs{$partition}{endtime}
$jobs{$partition}{rc}
[download]

You examine each line and determine:

• Is this the beginning of a new job? If so, store jobname, starttime.
• Is this the end of a job? If so, have I recorded the start info for this job? if so, store endtime, rc, report, delete entry.
• Ignore if neither of the above is true

Determine your strategy for what happens when you reach EOF:

• Ignore the jobs started but not finished (or at least report that fact with the data you have)?
• Choose an ending point in the log file where the partitions are all quiet?

The regexen used to parse each line should be fairly straight forward, you only have to read the file once, and you keep storage to a minimum. Would this be the most efficient way to do it? I don't know but as I said, during the coding process, you may gain some insight to try something different.

--Jim